Loading malware…
MiniRAT is a Go-based macOS remote access trojan/backdoor observed in the wild and associated with the financially motivated threat cluster JINX-0164. It has been delivered via a software supply-chain compromise involving the trojanized npm package @velora-dex/sdk version 4.9.1, whose modified initialization logic downloaded a shell script that installed the malware on downstream developer systems. Reporting also ties MiniRAT to broader JINX-0164 operations targeting macOS software developers, including developers at cryptocurrency and financial firms.
MiniRAT is described as a lightweight Go backdoor compiled for darwin arm64. It performs anti-virtualization checks and exits if virtualization artifacts are detected, including checks of scutil, sysctl, and ioreg output for strings associated with VirtualBox, Oracle, VMware, Parallels, and generic virtual machine indicators. It enforces single-instance execution using an exclusive lock on $TMPDIR/updater.lock.
For persistence, MiniRAT modifies ~/.zshrc and creates the LaunchAgent plist ~/Library/LaunchAgents/com.apple.Terminal.profiler.plist, which runs /bin/zsh -i at load. It stores encrypted command-and-control configuration in ~/Library/Application Support/com.apple.Terminal/.cache. If the cache file is absent, the malware decrypts embedded JSON blobs using AES-CBC with PKCS7 padding and writes them locally. The content states that MiniRAT uses AES-encrypted C2 configuration and can rotate C2 servers by replacing the .cache file out-of-band.
Operationally, MiniRAT profiles the victim and registers the host with its C2 by uploading host and geolocation data as info.json. Collected data includes username, hostname, macOS version, CPU model, CPU architecture, public IP address, country, region, created_at, and last_access. It obtains the public IP from api.ipify.org and geolocation data from ipinfo.io/json. It then polls action.json over HTTP(S) for tasking using a per-agent agent_key and updates info.json with refreshed last_access values.
Supported operator actions include arbitrary shell command execution via /bin/sh -c, file upload/exfiltration, and file download from the attacker-controlled server, providing persistent remote access and post-compromise control. MiniRAT writes logs to $TMPDIR/updater.log. Filesystem artifacts explicitly identified in the content include modified ~/.zshrc, ~/Library/LaunchAgents/com.apple.Terminal.profiler.plist, ~/Library/Application Support/com.apple.Terminal/.cache, ~/Library/Application Support/com.apple.Terminal/profiler, $TMPDIR/updater.lock, and $TMPDIR/updater.log.
The malware is linked in reporting to the same command-and-control infrastructure as AUDIOFIX, with both families communicating through datahub.ink.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They modified the package initialization scripts to download a backdoor named MINIRAT automatically .
23 distinct techniques documented for this family, organized by ATT&CK tactic.
On April 7, 2026, JINX-0164 conducted a supply chain operation by trojanizing version 4.9.1 of the npm package @velora-dex/sdk.
The malicious package appended three lines to dist/index.js, which attempts to download a shell script whenever the package was imported.
It contains basic backdoor functionality to upload and download files and execute arbitrary shell commands
The operator commands: command: Executes an arbitrary shell command on the victim machine via the internal helper alibaba.xyz/minirat/internal/utility.ExecuteCommand, which invokes `/bin/sh -c <command>`.
Upon clicking, the victim unknowingly downloaded and executed a macOS-specific malware with remote access tool (RAT) capabilities.
The threat actors inject malicious payloads straight into unverified software branches... For instance, the group successfully trojanized a public developer package on the npm registry. They modified the package initialization scripts to download a backdoor named MINIRAT automatically.
The malware further creates a launch agent plist which launches the command in .zshrc when run with zsh -i: ~/Library/LaunchAgents/com.apple.Terminal.profiler.plist.
The malware further creates a launch agent plist which launches the command in .zshrc when run with zsh -i: ~/Library/LaunchAgents/com.apple.Terminal.profiler.plist.
The invitation included a link to a malicious domain disguised as a legitimate conferencing platform, such as Microsoft Teams. After interacting with the link, the victim executed a malicious file disguised as the meeting client.
com.apple.Terminal.profiler label and Application Support/com.apple.Terminal/ path
The first action performed is a call to IsVirtualMachine, an anti-analysis check designed to detect whether the sample is executing inside a virtualized or sandboxed environment.
The threat actors inject malicious payloads straight into unverified software branches... For instance, the group successfully trojanized a public developer package on the npm registry. They modified the package initialization scripts to download a backdoor named MINIRAT automatically.
The malware communicates with its C2 server over HTTP(S) using two JSON-based channels, both keyed by the per-agent <agent_key> parameter.
download: Retrieves a file from the attacker's server and writes it to a specified location on the victim, enabling delivery of secondary payloads, tools, or updated implant versions.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor/RAT delivered through a trojanized npm package as part of a software supply chain attack against downstream users.
Go-based backdoor employed in the campaign; previously distributed via a compromised npm package.
A lightweight Go-based macOS backdoor/RAT delivered via a trojanized npm package in a supply chain attack. It registers infected hosts with shared C2 infrastructure, provides persistent remote access, and allows operators to execute commands and move files.
A Go-based backdoor delivered through a compromised npm package, capable of uploading files, executing arbitrary shell commands, and fetching additional payloads or tools from attacker-controlled domains.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.